School Workbench is a schoolwork-organization service operated by School Workbench, LLC ("we," "us"), a Rhode Island limited liability company based in Lincoln, Rhode Island, United States. Your data is stored and processed in the United States. We are built to read the least data necessary, keep it secure, and leave control with the School and the student. This policy explains what we access, why, and the choices you have.
When a School or district deploys School Workbench, the School is the controller of student data and we process it on the School's behalf and instructions. For any individual who connects the Service outside a School deployment, that individual controls their own data. The Service is not offered to children under 13 outside a School deployment.
Everything we read from your Google account and your School's systems is read-only. Google data comes through Google's official APIs and consent screen. Data from your School's other systems comes only from the integrations your School chooses to connect (see Section 2a); we never receive anything from a system your School hasn't connected. Each item is used only for the feature described:
Signing in asks for your profile, Google Classroom, and Google Calendar only, all read-only. Parents sign in with profile only (name and email). Gmail and Drive are not requested today. They are an optional add-on a School may purchase in the future; if we offer it, it will be turned on only for a School that buys it, after any additional review Google requires, and each student would see a separate Google consent screen and choose whether to connect. Until a School has the add-on and a student connects it, the Service never asks for Gmail or Drive and cannot read them. We request read-only scopes only. The Service cannot send, post, delete, or alter anything in your Google account, and it accesses only the categories listed above. Gmail and Drive are Google restricted scopes; if offered, our use of them will be limited to the features described here and complies with the Limited Use requirements in Section 3. Your School's Google Workspace administrator can also allow or block any of these connections for the School's users from the Google side.
School Workbench can connect to several systems a school may already use. Each School decides which ones to use; they are independent of each other, and a School can use any combination or none. A School administrator connects each one from the School Workbench admin panel, using an approval or credentials that come from that system and the School's own authority to share its data with us, and can disconnect it at any time. Every connection is read-only: we cannot create, change or delete anything in the School's systems, and those systems remain the official record.
| Integration | What we receive | Default |
|---|---|---|
| Google Classroom | Courses, coursework, due dates, topics and announcements for each signed-in student and teacher | On; the School can turn it off |
| Rediker (AdminPlus, TeacherPlus, PlusPortals) | Classes, students, teachers and guardians. Rediker's API currently provides rostering only. If it makes gradebook assignments available to us, we would also receive each assignment's title, description, category and due date and whether a student's work is marked handed in. No scores, grades or comments. | Off until the School connects it |
| Blackbaud | Students (name, school email, grade level), class enrollments, and each class’s published assignments (title, description, type, due date), copied into students’ plans. No handed-in status, scores, grades or comments. With the parent panel add-on, also the records described in Section 7f. | Off until the School connects it. Once connected, the School can keep Blackbaud classes and assignments out of students’ plans. |
| ClassLink or Clever (Class Sync, OneRoster) | Classes, students, teachers, and guardians linked to students | Off until the School connects it |
| Canvas or Schoology (LTI 1.3) | Each user's name, school email and LMS identifier at sign-in | Off until the School connects it |
| Spreadsheet upload | The parent–student links in a file the School uploads (Section 7g) | Only when the School uploads one |
When a School disconnects an integration, we stop reading it at once and delete the data it supplied: staged class lists and assignments are deleted immediately and removed from each account at its next sync, and Blackbaud data is deleted as described in Section 7f. Classes and work that also came from another integration the School still uses stay. If we add an integration, it will be off for every School until that School turns it on, and we will update this list first.
Solely to provide the Service to you: to display your assignments, rank your work by urgency, extract dates, plan your week, and let Gabriel, our AI coach, answer questions grounded in your own materials and make changes in your account when you ask it to (see Section 4). We also use your name and school email address to send service notices and, with your School's agreement, optional surveys about the Service (see Section 7i). We do not sell your data, use it for advertising, or use it to train advertising or generalized AI/ML models. Our use of Google user data adheres to the Google API Services User Data Policy, including its Limited Use requirements.
We do not share student data with third parties except: (a) the infrastructure providers needed to run the Service, under confidentiality obligations; (b) as your School directs; or (c) as required by law. We never sell it. Our current subprocessors are Amazon Web Services (cloud hosting and AI, United States); Google (the source of the data you authorize us to read); Apple (delivering push notifications to the iPhone app, which receive only the notification text); and, only where your School turns them on, Blackbaud and your School's rostering provider or student information system (such as ClassLink, Clever or Rediker). We also use Tailscale to secure our own administrative access to our servers, and Resend (United States) to deliver email: messages from our website (the contact form and our newsletter; see Section 7h), and service emails and survey invitations to users of the Service (see Section 7i). For service emails, Resend receives only the recipient's name, school email address and the message itself, never any other student data. Tailscale receives no student data. Gabriel's language model (Anthropic's Claude) is run by Amazon Web Services through Amazon Bedrock, within the same AWS subprocessor relationship; Anthropic does not receive your data, and it is not used to train any model. A current subprocessor list is maintained for Schools in the Data Processing Addendum; Schools receive at least 30 days' notice before we add a new subprocessor.
De-identified data. We may keep and use aggregate, de-identified statistics (see Section 7b) to operate and improve the Service. We will never attempt to re-identify them and never publish them in a form that could identify a student or a School without the School's consent.
Change of control. If School Workbench is acquired by, or merges with, another organization, student data remains subject to this policy and to each School Agreement. We will notify affected Schools before any transfer, and a School may direct us to delete its data instead.
This section is our data retention policy. We keep personal information only for as long as it is needed for the purpose it was collected for, and then delete it. We do not keep student data indefinitely.
| What we keep | Why we need it | How long |
|---|---|---|
| Account profile (name, school email, picture) and encrypted Google access tokens | Signing you in and reading the data you or your School authorized | While the account exists. Google access is revoked and the record erased when the account is deleted. |
| Classroom courses, assignments, announcements and topics | Showing and ranking your work | While the account exists; refreshed at each sync. Removed at the next sync if your School turns Classroom off. |
| Class lists, assignments and handed-in status from your School's other connected systems (Section 2a) | Setting up classes and showing your work | Replaced at every sync. Deleted when your School disconnects that integration or the agreement ends. |
| Email sender, subject, preview and AI summary (encrypted) | Flagging school email and summarizing messages you open | 90 days from when the email was received. |
| Calendar events (including ones you add) and saved study-plan blocks | The calendar view and Plan my day | Calendar events: 30 days after the event. Plan blocks: 90 days. |
| Conversations with Gabriel, the record of changes Gabriel made at your request, attached-file text (including text read from photos), and generated study materials | Resuming your work; School oversight for academic integrity and safety | While the account exists, or a shorter period your School instructs. |
| Files you attach to a conversation with Gabriel | Letting Gabriel read them | Until you delete them or the account is deleted. For a photo we keep only the text read from it, not the picture. |
| To-dos you add | Showing them with your work and in your plan | Until you delete them, choose Start fresh, or the account is deleted. |
| Library files, their text and AI summaries (encrypted; visible only to you) | Keeping your notes and study files in one place | Until you delete them, choose Start fresh, or the account is deleted. Turning the Library off does not delete them. |
| Learning profile (topics, onboarding answers) and effort estimates | Tailoring help and time estimates | Until you clear it in Settings or the account is deleted. |
| Usage records and error logs (pseudonymous) | Operating, securing and fixing the Service | Usage: 90 days. Errors: 30 days. Only identifier-free counts are kept longer. |
| Parent panel records and the parent access log | Showing a parent their own child's school information | Records and parent links: until the School disconnects Blackbaud, replaces or removes the links, or the agreement ends. A parent the School removes loses access immediately and their record is deleted within 30 days. Access log: 12 months. |
| Database backups and server disk snapshots | Recovering from data loss | Daily database backups: 30 days. Server disk snapshots: 14 days. Both are encrypted and stay in our AWS account in the United States, used only to restore lost data. |
| Survey answers and service email send records | Improving the Service; avoiding duplicate emails | Survey answers: 12 months, or until the School's agreement ends if sooner. Email send records: 12 months. |
| Push notification send records (iPhone app) | Avoiding duplicate reminders | 60 days. |
Deleting an account. You or your School may request deletion at any time. Choosing "Delete my account" in Settings disables your account immediately — it disappears from the app and from any teacher or administrator view at once, on every device — and permanently erases all stored School Workbench data after a 30-day grace period. Signing back in within those 30 days restores the account; after that the erasure is irreversible, and our access to your Google account is revoked. Nothing in your Google account is ever changed.
When a School leaves. On termination of a School agreement, we return or delete School data within 30 days. Deletion removes the records from the live database at once; copies in backups and disk snapshots are deleted on their normal schedule (within a further 30 days) and are never restored except to recover from data loss.
School Workbench uses no advertising or tracking cookies, and no third-party analytics. We set a single, strictly necessary cookie — a signed session cookie (sw.sid) that keeps you logged in; it is HttpOnly, SameSite=Lax, and (in production) Secure. Your browser also stores small localStorage values to remember your light/dark theme and your app preferences, including changes to tonight's plan. Because we use only strictly necessary storage, no cookie-consent banner is required.
To understand whether the Service is helping students and to keep it running reliably, we measure how it is used. This is first-party and self-hosted — it is never sent to Google Analytics or any third-party or advertising service. For each use, we record only:
We deliberately do not record the content of anything — no messages, assignment titles, email text, or study material — and we do not collect IP addresses, device or browser fingerprints, or location for analytics. We do not sell this data, use it for advertising, or use it to build a non-educational profile. Identifiable usage rows are automatically deleted after 90 days; only aggregate, identifier-free daily counts (for example, "42 students were active on this date") are kept longer for trend reporting. The School-facing view of this data is aggregate only. Deleting your account (Section 7) removes your usage records along with the rest of your data.
When something goes wrong in the Service, we record a short technical description of the failure (an error code, the page or feature involved, and the time), together with the pseudonymous account identifier and school domain of the affected user so that we can fix it and so that the School's administrator can see, in aggregate, what their users ran into. Error records never contain message text, assignment content, email content, or IP addresses. Identifiable error records are deleted after 30 days; only identifier-free counts per error type are kept longer.
The School Workbench app for iPhone shows the same Service. Sign-in happens in the system browser, so the app never sees your Google password. Due-date reminders are scheduled on your phone from the assignment titles and due dates already in your account; they are off by default. If you allow notifications, the app also registers your phone's Apple push token with us so we can send alerts such as "new assignment posted" (and, for parents, a recorded absence or late arrival). An alert contains only a short title and one line, never grades or comments, and is delivered through Apple's push notification service. We keep the push token and your notification choices only to send these alerts, and a record of each alert sent for 60 days so it is never sent twice. You can turn alerts off in the app's Settings or in iOS Settings; signing out of the app deletes its push token from our servers, and deleting your account deletes the token, your choices, and the send records.
When a School connects Blackbaud, we read the School's Blackbaud records through Blackbaud's official SKY API under a connection the School's own Blackbaud administrator authorizes. For students' plans we read the student directory (names, school emails, grade level), class enrollments, and each class's published assignments, and copy each student's classes and assignments into their own account; the School's connection does not tell us what a student handed in, so students mark their own work done. The School can turn this off at any time, which removes those classes and assignments from students' accounts. Where the School also enables the parent panel (parent.schoolworkbench.com), we additionally read: the parent and student directory (names, emails, grade level), which parents are linked to which students and with what access, class enrollments and schedules, assignments, gradebook entries, and attendance marks. We do not read financial, medical, admissions, or fundraising records, and we cannot write anything back to Blackbaud. Parents see only the students Blackbaud links to them with parental access, and grades only where Blackbaud and the School allow it. A parent's Google sign-in gives us their name and email only, used to match them to the School's record. Blackbaud permits gradebook data to be read only by a parent's or student's own account, so a parent who chooses to link their Blackbaud ID authorizes us to hold an encrypted token for their account, which we use solely to read their own children's grades and assignments and never to write. A parent may unlink it at any time from Settings, which deletes the token; it is also deleted when the School removes the parent or disconnects Blackbaud. We keep a log of which child's pages each parent viewed and when, visible to the School's administrator, for 12 months. Blackbaud is a subprocessor for this feature (United States). We refresh this data hourly and delete all of it, including parent tokens and the access log, when the School disconnects Blackbaud, deletes its account, or the agreement ends.
A School that does not use Blackbaud may link parents and guardians to students in one of two ways: by sharing guardian records from its rostering provider or student information system (such as ClassLink, Clever or Rediker, using the OneRoster standard), which we refresh nightly, or by uploading a file exported from its student information system. In both cases the School decides who is linked to whom; a parent can never add or choose a child. We accept a link only for a student whose email address belongs to that School's own email domain. Each new upload or sync replaces the previous one, and a parent the School no longer lists loses access immediately.
A parent signs in with Google; we receive only their name and email address, and the email must be one Google has verified and that exactly matches the School's record. A linked parent can see, for their own child only: the child's classes and teachers, assignments and due dates, posts from the child's teachers, and absences and late arrivals that teachers recorded in School Workbench. A parent cannot see the child's email, Google Drive files, Calendar events, personal to-dos, conversations with Gabriel, uploaded files, or study materials. Grades and bell schedules are not shown in this mode. If the child has not yet signed in to School Workbench, the parent sees only the child's name, as provided by the School.
We keep the same 12-month log of which child's pages each parent viewed, visible to the School's administrator. When the School removes a parent, replaces its links, deletes its account, or the agreement ends, the corresponding parent records are deleted as described in Section 7.
The public demo uses fictional students, teachers, and coursework. Nothing in it is real data, and demo activity is excluded from the analytics and error logs described above.
These are separate from the Service and never involve student data. When you use the contact form, we receive the name, organization, email address and message you enter, delivered to our support inbox through our email provider, Resend (United States), and we use them only to reply to you. When you sign up for our newsletter, we keep your email address in Resend to send you occasional product news. Every newsletter includes an unsubscribe link, and you can also ask us at support@schoolworkbench.com to remove you at any time. We never sell these addresses, never add anyone to the newsletter without their signup, and never use students' email addresses for marketing. Teachers and School administrators receive product updates only as described in Section 7i.
Service notices. We may tell users about the Service itself: an outage or planned maintenance, a security notice, a change to a feature they use, or a change to this policy. We show these inside the app and may also send them by email through Resend, which receives only the recipient's name, school email address and the message. Students never receive advertising or marketing from us, by email or in the app.
Teachers and administrators. In addition to service notices, teachers and School administrators may receive occasional product updates by email. Each one includes an unsubscribe link, and unsubscribing never affects service notices or access to the Service.
Surveys. With the School's agreement, we may invite users, including students, to answer short surveys about the Service, in the app or by email. Surveys are always optional, and choosing not to answer never affects anyone's use of the Service. Answers are used only to improve the Service, are never used for advertising, and are shared with the School only in aggregate or as the School directs. Our surveys do not ask about political beliefs, mental or psychological problems, sexual behavior or attitudes, illegal or self-incriminating behavior, critical appraisals of family members, privileged relationships, religious practices, or income. Survey answers are deleted within 12 months, or when the School's agreement ends if that comes first.
If we become aware of a breach of security leading to unauthorized access to student data, we will notify the affected School without undue delay and no later than 72 hours after we become aware of it, and cooperate with the School's obligations under FERPA, COPPA, and applicable state law.
School Workbench is intended for use within schools. For students under 13, the School provides consent on behalf of parents consistent with COPPA's school-consent provisions; we act as a school official with a legitimate educational interest under FERPA and use student data only for the authorized educational purpose. We rely on the School's authority and direction for student users.
Parents of children under 13. You may ask to review the personal information we hold about your child, ask us to delete it, and refuse to allow any further collection or use of it. Because the School authorized the Service on your behalf, make the request through your child's School, or write to us at the address in Section 13 and we will work with the School to verify the request and act on it. We do not disclose a child's personal information to third parties other than the service providers listed in Section 6, who may use it only to run the Service for us. We do not ask a child for more information than is reasonably needed to use the Service.
Parents and eligible students. Under FERPA, parents and eligible students may inspect and request correction of education records through their School. We assist the School with any such request within 10 business days. We collect no more student data than the School authorizes, do not condition use of the Service on consent to collect data beyond what the Service needs, and do not use student data to build a profile of a student for any purpose other than providing the Service.
We support Schools' compliance with applicable state student-data-privacy laws in the jurisdictions where our partner Schools operate. Where a state requires specific contractual terms, those are addressed in the Data Processing Addendum. This includes Rhode Island's student-data law (R.I. Gen. Laws Chapter 16-104), which prohibits a cloud service from processing student data for any commercial purpose unrelated to the educational service. We do not, and we do not use student data for targeted advertising in any state.
You can revoke access from your Google Account's security settings at any time, clear your workspace from Settings (Start fresh removes your synced classes, assignments, your own to-dos, email, calendar, study materials, uploaded files, your Library, and what Gabriel has learned about you, while your School keeps access to your conversations with Gabriel for oversight as Section 4 describes), delete your account and data from Settings, and contact us to ask what we hold about you, to request a copy of it, or to have it corrected or deleted. Where a School deployment applies, we will route the request through your School as FERPA requires. We acknowledge every privacy request within 5 business days and never charge for one.
We will post material changes here and update the date above. For School deployments, we will notify the School at least 30 days before a material change affecting student data takes effect, and we will not make a change that reduces the protection of student data without the School's agreement.
Privacy questions or requests: support@schoolworkbench.com. The operator of the Service is School Workbench, LLC, 33 Timberland Dr, Lincoln, RI 02865, telephone 401-864-1333. See also our Data Processing Addendum for Schools.